SEC-3136: Allow for array Http methods and varargs patterns for Ant matcher

Abhijit Sarkar (Migrated from SEC-3136) said:

Often times, the same security requirement applies to multiple Http methods. For example, "any POST, DELETE, PUT or PATCH must only be accessible to the admins, regardless of the URL pattern". The Ant matchers have 2 methods, one that takes a URL pattern and applies to all Http methods and another that takes a Http method and applies to a varargs URL patterns. None of these methods could be used in the above use case requiring redundant code like the following. It'd be nice to have an ant matcher that could take a array Http method and varargs patterns as arguments.

protected void configure(HttpSecurity http) throws Exception {
    http
    .authorizeRequests()
    .antMatchers(GET, SECURE_PATTERNS).authenticated()
    .antMatchers(POST).hasAnyRole("ADMIN")
    .antMatchers(DELETE).hasAnyRole("ADMIN")
    .antMatchers(PUT).hasAnyRole("ADMIN")
    .antMatchers(PATCH).hasAnyRole("ADMIN").and()
    .httpBasic()
    .and().csrf().disable() 
    .userDetailsService(userDetailsService); //
}

Start from the antMatchers methods in the HttpSecurity authorization configuration, comparing the overload that accepts a single HTTP method with the overload that accepts multiple URL patterns. Done means a matcher can accept an array of HTTP methods and varargs URL patterns, supporting the stated POST, DELETE, PUT, and PATCH example without redundant calls.